Re: more efficent big scoring

2008-01-18 Thread jdow
From: "Robert - elists" <[EMAIL PROTECTED]> Sent: Friday, 2008, January 18 21:14 You can't run the rules in score-order without driving SA's performance into the ground. The key here is SA doesn't run tests sequentially, it runs them in parallel as it works its way through the body. this allo

RE: more efficent big scoring

2008-01-18 Thread Robert - elists
> > You can't run the rules in score-order without driving SA's performance > into the ground. > > The key here is SA doesn't run tests sequentially, it runs them in > parallel as it works its way through the body. this allows for good, > efficient use of memory cache. > > By running rules in sc

Re: more efficent big scoring

2008-01-18 Thread Theo Van Dinter
Yes and no. There aren't many negative scored rules, which could easily be put into a low priority to run first. The issue, which is where Matt was going I believe, is that the reason score based short circuiting was removed is that it's horribly slow to keep checking the score after each rule ru

Re: more efficent big scoring

2008-01-18 Thread Matt Kettler
You can't run the rules in score-order without driving SA's performance into the ground. The key here is SA doesn't run tests sequentially, it runs them in parallel as it works its way through the body. this allows for good, efficient use of memory cache. By running rules in score-order, you

Re: sa-learn error message

2008-01-18 Thread Jari Fredriksson
> Hello Craig, > > I recently ran into this problem myself. The solution, > after being a dolt and not running a backup first, was > the following sequence followed by line definitions: > >/etc/init.d/mailserver stop >sa-learn --backup > /etc/mail/spamassassin/database.bak >sa-learn

Re: sa-learn error message

2008-01-18 Thread Brian Eliassen
Hello Craig, I recently ran into this problem myself. The solution, after being a dolt and not running a backup first, was the following sequence followed by line definitions: /etc/init.d/mailserver stop sa-learn --backup > /etc/mail/spamassassin/database.bak sa-learn --dump magic

Disabling eval rules (was: Re: Testing Botnet)

2008-01-18 Thread Karsten Bräckelmann
On Sat, 2008-01-12 at 12:23 -0800, Robert - elists wrote: > > Sounds like you've been hit by bug 5519 [1] before the upgrade in Oct. > > Setting rules scores to 0 did *not* prevent these tests from being > > evaluated for SA 3.2.x before 3.2.3. > > > > Fixed since 3.2.3. Plugin eval rules with 0

more efficent big scoring

2008-01-18 Thread George Georgalis
Noticed today (again) how long some messages take to test. The first thing that comes to mind is some dns is getting overloaded answering joe-job rbldns backskatter, causing timeouts or slow responce times. Then I was thinking about how some tests are excluded because they generate too much regex

Re: disable all network test except ...

2008-01-18 Thread Stefan Jakobs
On Friday 18 January 2008 13:46, you wrote: > Stefan Jakobs wrote: > > Hello list, > > > > I'm using amavisd-new with spamassassin and for some tests I have to > > disable all network tests in spamassassin except for sorbs, njabl, uribl > > and maybe some other blackhole lists. > > I guess I can co

Re: disable all network test except ...

2008-01-18 Thread mouss
Stefan Jakobs wrote: Hello list, I'm using amavisd-new with spamassassin and for some tests I have to disable all network tests in spamassassin except for sorbs, njabl, uribl and maybe some other blackhole lists. I guess I can comment out the corresponding header lines in the files 20_dnsbl_t

Re: The googolbees are getting craftier

2008-01-18 Thread Jeff Chan
Quoting Justin Mason <[EMAIL PROTECTED]>: the redirect detection should have no problem finding that... And the redirected-to domain is on two SURBL blacklists, so it should be hitting. Jeff C. Loren Wilton writes: I guess btnl is no longer working. Now they are doing a redirect: htt

Re: disable all network test except ...

2008-01-18 Thread Matt Kettler
Stefan Jakobs wrote: Hello list, I'm using amavisd-new with spamassassin and for some tests I have to disable all network tests in spamassassin except for sorbs, njabl, uribl and maybe some other blackhole lists. I guess I can comment out the corresponding header lines in the files 20_dnsbl_t

Re: The googolbees are getting craftier

2008-01-18 Thread Justin Mason
the redirect detection should have no problem finding that... Loren Wilton writes: > I guess btnl is no longer working. Now they are doing a redirect: > > http://google.co.uk///pagead/iclk?sa=l&ai=livermore&num=970&adurl=http://-low-rate.tw?beast > > > Loren

disable all network test except ...

2008-01-18 Thread Stefan Jakobs
Hello list, I'm using amavisd-new with spamassassin and for some tests I have to disable all network tests in spamassassin except for sorbs, njabl, uribl and maybe some other blackhole lists. I guess I can comment out the corresponding header lines in the files 20_dnsbl_tests.cf and 25_uribl.cf

The googolbees are getting craftier

2008-01-18 Thread Loren Wilton
I guess btnl is no longer working. Now they are doing a redirect: http://google.co.uk///pagead/iclk?sa=l&ai=livermore&num=970&adurl=http://christmas-low-rate.tw?beast Loren